From d584c170e56bfb6e9aee9b09f30d7f057b08559a Mon Sep 17 00:00:00 2001 From: Andrew Lukoshko Date: Wed, 15 Apr 2026 15:19:12 +0000 Subject: [PATCH] Sync with a9 --- .gitignore | 2 + .shim.metadata | 10 +-- SOURCES/BOOTAA64.CSV | Bin 124 -> 122 bytes SOURCES/BOOTIA32.CSV | Bin 124 -> 0 bytes SOURCES/BOOTX64.CSV | Bin 122 -> 120 bytes SOURCES/almalinuxsecureboot0.cer | Bin 0 -> 999 bytes SOURCES/almalinuxsecurebootca0.cer | Bin 1787 -> 970 bytes SOURCES/fbaa64.efi | 0 SOURCES/mmaa64.efi | 0 SOURCES/shim.rpmmacros | 19 +++--- SPECS/shim.spec | 97 ++++++++++++++++++++--------- 11 files changed, 88 insertions(+), 40 deletions(-) delete mode 100644 SOURCES/BOOTIA32.CSV create mode 100644 SOURCES/almalinuxsecureboot0.cer delete mode 100644 SOURCES/fbaa64.efi delete mode 100644 SOURCES/mmaa64.efi diff --git a/.gitignore b/.gitignore index e57fc72..8cdce47 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,6 @@ +SOURCES/fbaa64.efi SOURCES/fbx64.efi +SOURCES/mmaa64.efi SOURCES/mmx64.efi SOURCES/shimaa64.efi SOURCES/shimx64.efi diff --git a/.shim.metadata b/.shim.metadata index 177bafb..f06ddac 100644 --- a/.shim.metadata +++ b/.shim.metadata @@ -1,4 +1,6 @@ -bfee65ae45498fefd64b16edf9993415b625cb3c SOURCES/shimaa64.efi -8d5251f1166c9dd43426903459fe95d4bd262483 SOURCES/shimx64.efi -122b21c2da0ca4ee839d4bb6beff7ddffd68f1a0 SOURCES/fbx64.efi -a4f7a273cc9a531a6ef125b91353f479cfa5f79c SOURCES/mmx64.efi +7acd733679930ea1fb7dca35ab4fef0486653fbf SOURCES/fbaa64.efi +3dca48b357a96c65a9928bbd5c4f814c7f4817ba SOURCES/fbx64.efi +0dfbc60bb515830779115580cb23e2df6cd02906 SOURCES/mmaa64.efi +c5b15cc7e0c29119467804e0671a6bef049e1d17 SOURCES/mmx64.efi +03ff27cdfc981bd3c4afce0c8deab4175618a07e SOURCES/shimaa64.efi +03ba5f1ca6d83d48248471649cb73daeba1a32ea SOURCES/shimx64.efi diff --git a/SOURCES/BOOTAA64.CSV b/SOURCES/BOOTAA64.CSV index 3ef9ab912bd5e9e68661f89ee324b147d9282064..25648361c3733b5de252019cdb99a43ae4a85585 100644 GIT binary patch delta 62 zcmb=aQZ8o5V8~?1Wk>`q<&zY#|ECS~MrScd`87dgK7yy@) B3~m4b delta 41 pcmb=bVfz1Xf)uACLk>eOLn4FEL}h0YIENvVA&;Syp@M;n0RaCW3J?GQ diff --git a/SOURCES/BOOTIA32.CSV b/SOURCES/BOOTIA32.CSV deleted file mode 100644 index a45da43844da52778badecb23ca75128fa8b98b6..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 124 zcmZXMOA3H63`F1BQ+R;lLQmk{r5C8sqTmPG2zq&SbSoj5na7a(%8X1bT2DhwMIb6U nT4r%ir?j$jh&lSNpD9J(Ysx`7uxU&#sBI)p`6!m8|6c_UDmE8} diff --git a/SOURCES/BOOTX64.CSV b/SOURCES/BOOTX64.CSV index 38a9ef0a67ed2de1e037a1e119941ec1fb374836..4aa8eae42449df050e62f8c1b261c6728ca7ddc5 100644 GIT binary patch delta 60 zcmb=bP%LK1V8~?1WvE~eOLn4FEL`7#2IENvVA&;Syp@M;n0Ra993J3rI diff --git a/SOURCES/almalinuxsecureboot0.cer b/SOURCES/almalinuxsecureboot0.cer new file mode 100644 index 0000000000000000000000000000000000000000..e6bb9db458dcdd38c1d601a5160ce8464ad028e0 GIT binary patch literal 999 zcmXqLVt#DU#B_QAGZP~dlSq=$x3`I_j%l#2FGy70?o}0&^C`xFmyJ`a&7`|WU>24@s0aobma5>CpI@Tj>}Vh-&TC|9U~Ft?Xklb& zVh|5{Q*3?l-?gr~{?8kbg0b5t?lBx5kIj7}g65w>>_kj-vx$A0zuP(QmrG2u2oc z48%ZuRS=)YfQyYon~jl`m7ST{Ko%s<$0Eie@_$b83%6N8)15EgoM>+NBkWY&gl=$> zkyU1qFc51HIoS8|=e1RqCd=#0HZEQp>z27>$v)(`0j5`A+%Ph@OKKIL-ult%`<1Av z5-(2v5nVsM&G$=Ot(U)hQd!P8?3PlTo-)sPC%) z%GRv~6F;VMvx!~hPrProZ&#m`UU0&*YmVC)`!Achh~HyQ{q4DbyFt~aQ_2ejlC}W= DeSwFp literal 0 HcmV?d00001 diff --git a/SOURCES/almalinuxsecurebootca0.cer b/SOURCES/almalinuxsecurebootca0.cer index 6a4e99b9ed921c4af3db55a619260f1ab76110dc..d086cd53c500ca15c889ff2b32c5b6167e162cb5 100644 GIT binary patch literal 970 zcmXqLVm@Zj#I$Y!GZP~dlOV(4Zs(9&d=69Em3g11sAkV^L6cZ~>O)f3UEU9!z%*jp6$;>OQ(917MH&if?V`C0w;Sv^i1d98B#1;I5 z72NVm^HLH^GV}8c6%FJ;Dwu^O5GsN}hNUVv<>!|uI6E51iSrtn7#JIx7#Nxw8X8B5 z^BN;_>Fk;&MkVCnU}R-rZerwTFlb`rVrpV!WY}_t7Ne;@l2>AiQadDHC2MrTVB zO(Lpfw^>Si%esGJa$bBkT4%~@SA&z4SLRpsX_nubYp1hTKIzu}WsAQ2p~ zvdSzH24W2&2m4H!6-7=Rf*=N89jCompM#ldvEWm`W}#J zxk}xi#o5);HktIgnC#)1`JOlE+oS{&KE=3)&u#8$74Y|m%cOL+Z;IVzN<(T-->Cg@tAgaZeR7U zoO6kLraH9v^FEAbn0rzC{=8|?{>9&=0(}ZDUbr5qpi+Ngkv!MxEhXG;4@Gr@<_V~8 hz1^Yl@Bi1C6W7#=r%k@Xm3H;jpD6o4&JuOO^8kV}d_DjG literal 1787 zcmb7Edpy%?9NzEu+YQ4qp+X~z$hNhS)Qi`TME^-dksg&-Xq2Cz{bpoK?*v3Lr+#1l0EMjD_^(GTMD zB!UPL)n5=TknqD$I+(55K`6BGoxr#aQ34*7AqwMDg9H&mfiQx~@Sw6ns4M2o1LnrM zj*bAGgM!g7R1KZf5ID|pa&dAA1xdG2GSJgV;wS_sr+Fwqoly#ygx9gdLs&@Wya0v} z3LG4SP65Uf7hwvK$&cd3bH#kr3{2A~=u->>#eywd37;Auj^GLf30#RlB%EMPEi-l+ zkwox{5{U(2T$BpTN6nIqJ))wy{sLj#R%$>H)k_p74EruH#z6j)0c5b{#3zMt7(@o^ zW7O-~undMU6>I1J?%P(;)EDTd~@7#vAD%qZ-ufkhh?j~ zapii8FZ6l4l2j4>$6Kvd%=FCfQ#Hi8bqZPzauDLVg0k(jF6nNqtfiz|Wxur8bX2ad zdVcV5sacnCY_nO@_S&kodX}Gu=_h9qjw-&C&Q?YW8|~hwL@-lYMZxo*mT|n_rq!Dq zNO?Kr*Z&ajuCl*+CptA}bH}3+sZUn7lNIOqU@O10Y8v~wWKcZqMh{nDsrrHAqC?Fn zC5Od?^TaPN9vZwE>ENKiT9WIkzve%`+%Pg-+wtWhW?EoI?ykMo1m;;krtqoqrdY(Z z>AG~nTPIVAdtr9e$os^OcI}Pat4B7uw#bZr_Ev0CoO20G4yS!W8C%*eNtWAYpL#d* zedparl{a8zs7XrL79O+)cgO3rRq(Xe?bv+=_YavC&C0sI{5@^Isw>gKnC3h)7Af**$k{YWr>DKj@ce|HuYY$w-4X7busAnE?sO0 z%rpc&tP$2Q5p}pRNtx`QBY$$Hy}hi^EzC7xG%sfQ5Hy0tA}}ElkTi6P2EzaYC>lh= zl7Kdzs16YhM?esDptRPfdPAw7JRwLkg(U+Y4UdZT1n$5IPa2Kec@%;nJOpT9#`r7@ z85u`PBr&nB4i2&3%Ye=kMLRG8g8%`Ki%23t2=LQLO~*2UT1>u3z97|AGoqg0iKFNf zr^ZU-duM1WW2`Y49;^^`UC`BhARRwieNz#L243SBz!P*O|5I1;uO$Gbj#^URPsEFj znJ5J48Yh#m)_^Ae=Lv|2+!#zIQG$c)nJj+~w#N#V{a95^486KX5gC+(`LS(LuYLx& zmK=g#7W3C{btC1qgXHu|&hAt1mVpg9@qz7)LQjirTbE=%tB>VaJ{w|W+SRlqtM=qq z`BZ#(0JZP>i7X28yp;YFwn*+V^|hB(LiOc)PaARBXXK%~jS_tFjUyY$QX;*+r0V45 zkE=pT=tBm1C+#j}43w`s`%TdlzpX-LE<>U=F6|4*<{yn&V-xIkW##-D?u9_i{=os1 zQ~fq=HHqcUdPH1KbNZa$#kq3WF+jPXnVa;%`a)vjg(LknHdCYpovzocJ`VZSGQKX% z9VuvTNmoc+L-8N(4b3q2QAF;sQhj@I*nzv-=TicK8=0_FUZQQx>WuhjaYMX_P|t&zHv TseG#v;Fg#3=RT@0&At3@_pP4Z diff --git a/SOURCES/fbaa64.efi b/SOURCES/fbaa64.efi deleted file mode 100644 index e69de29..0000000 diff --git a/SOURCES/mmaa64.efi b/SOURCES/mmaa64.efi deleted file mode 100644 index e69de29..0000000 diff --git a/SOURCES/shim.rpmmacros b/SOURCES/shim.rpmmacros index 1530a04..a022b1e 100644 --- a/SOURCES/shim.rpmmacros +++ b/SOURCES/shim.rpmmacros @@ -3,6 +3,8 @@ %global vendor_token_str %{expand:%%{nil}%%{?vendor_token_name:-t "%{vendor_token_name}"}} %global vendor_cert_str %{expand:%%{!?vendor_cert_nickname:-c "Red Hat Test Certificate"}%%{?vendor_cert_nickname:-c "%%{vendor_cert_nickname}"}} +%global grub_version 2.06-27.el9_0.12 + %global bootcsvaa64 %{expand:%{SOURCE10}} %global bootcsvx64 %{expand:%{SOURCE12}} #%%global bootcsvarm %%{expand:%%{SOURCE13}} @@ -19,8 +21,8 @@ %global mmefix64 %{expand:%{SOURCE42}} #%%global mmefiarm %%{expand:%%{SOURCE43} -%global shimveraa64 15-6.el9.alma.1 -%global shimverx64 15.6-1.el9.alma.1 +%global shimveraa64 16.1-2.el9.alma.1 +%global shimverx64 16.1-1.el9.alma.1 #%%global shimverarm 15-1.el8 %global shimdiraa64 %{_datadir}/shim/%{shimveraa64}/aa64 @@ -60,6 +62,7 @@ Requires: dbxtool >= 0.6-3 \ Requires: almalinux(grub2-sig-key) >= 202303 \ Requires: almalinux(kernel-sig-key) >= 202303 \ %endif} \ +Conflicts: grub2-efi-%{-a*} < %{grub_version} \ %{expand:%%if 0%%{-p*} \ Provides: shim = %{version}-%{release} \ Provides: shim-signed = %{version}-%{release} \ @@ -120,7 +123,7 @@ version signed by the UEFI signing service. \ else \ cp -av %{-d*}/%{-b*}%{-a*}.efi %{-b*}%{-a*}-unsigned.efi \ fi \ - %{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi -n redhatsecureboot501 -a %{SOURCE2} -c %{SOURCE1} } \ + %{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi -n almalinuxsecureboot0 -a %{SOURCE2} -c %{SOURCE1} } \ %{nil} # -a @@ -174,10 +177,10 @@ install -m 0700 fb%{-a*}.efi \\\ # -A %define define_files(a:A:) \ %{expand:%%files -n shim-%{-a*}} \ -%{efi_esp_dir}/*%{-a*}*.efi \ -%{efi_esp_dir}/BOOT%{-A*}.CSV \ -%{efi_esp_boot}/*%{-a*}.efi \ -%{efi_esp_boot}/*%{-A*}.EFI \ +%%verify(not mtime) %{efi_esp_dir}/*%{-a*}*.efi \ +%%verify(not mtime) %{efi_esp_dir}/BOOT%{-A*}.CSV \ +%%verify(not mtime) %{efi_esp_boot}/*%{-a*}.efi \ +%%verify(not mtime) %{efi_esp_boot}/*%{-A*}.EFI \ %{nil} %ifarch x86_64 @@ -186,7 +189,7 @@ install -m 0700 fb%{-a*}.efi \\\ %global provide_legacy_shim 1 %endif %ifarch aarch64 -%global is_signed no +%global is_signed yes %global is_alt_signed no %global provide_legacy_shim 1 %endif diff --git a/SPECS/shim.spec b/SPECS/shim.spec index 1df64a4..62e9f33 100644 --- a/SPECS/shim.spec +++ b/SPECS/shim.spec @@ -1,11 +1,10 @@ -%global dist %{?dist}.alma %global efi_vendor almalinux %global efidir almalinux %global efi_esp_dir /boot/efi/EFI/%{efidir} Name: shim -Version: 15.6 -Release: 1.el9.alma.1 +Version: 16.1 +Release: 5%{?dist}.alma.1 Summary: First-stage UEFI bootloader License: BSD URL: https://github.com/rhboot/shim/ @@ -17,7 +16,8 @@ ExclusiveArch: %{efi} ExcludeArch: %{arm} %{ix86} Source0: shim.rpmmacros -Source1: almalinuxsecurebootca0.cer +Source1: almalinuxsecureboot0.cer +Source2: almalinuxsecurebootca0.cer # keep these two lists of sources synched up arch-wise. That is 0 and 10 # match, 1 and 11 match, ... @@ -37,18 +37,18 @@ Source42: fbx64.efi %include %{SOURCE0} BuildRequires: pesign >= 0.112-20.fc27 -# We need this because %%{efi} won't expand before choosing where to make -# the src.rpm in koji, and we could be on a non-efi architecture, in which -# case we won't have a valid expansion here... To be solved in the future -# (shim 16+) by making the unsigned packages all provide "shim-unsigned", so -# we can just BuildRequires that. -%ifarch x86_64 -## BuildRequires: %% {unsignedx64} = %% {shimverx64} -BuildRequires: shim-unsigned-x64 = 15.6-1.el9.alma.1 -%endif -%ifarch aarch64 -BuildRequires: %{unsignedaa64} = %{shimveraa64} -%endif +# Right now we're just including all of the parts from them as sources here +# to make the build+errata process less maddening. We do this because +# %%{efi} won't expand before choosing where to make the src.rpm in koji, +# and we could be on a non-efi architecture, in which case we won't have a +# valid expansion here... +# %% ifarch x86_64 +# BuildRequires: %% {unsignedx64} = %% {shimverx64} +# BuildRequires: %% {unsignedia32} = %% {shimveria32} +# %% endif +# %% ifarch aarch64 +# BuildRequires: %% {unsignedaa64} = %% {shimveraa64} +# %% endif #%%ifarch arm #BuildRequires: %%{unsignedarm} = %%{shimverarm} #%%endif @@ -75,7 +75,7 @@ cd shim-%{version} %if %{efi_has_alt_arch} %define_build -a %{efi_alt_arch} -A %{efi_alt_arch_upper} -i %{shimefialt} -b yes -c %{is_alt_signed} -d %{shimdiralt} %endif -%define_build -a %{efi_arch} -A %{efi_arch_upper} -i %{shimefi} -b yes -c %{is_signed} -d %{shimdir} +%define_build -a %{efi_arch} -A %{efi_arch_upper} -i %{shimefi} -b yes -c %{is_signed} -d %{_sourcedir} %install rm -rf $RPM_BUILD_ROOT @@ -104,62 +104,103 @@ install -m 0700 %{shimefi} $RPM_BUILD_ROOT%{efi_esp_dir}/shim.efi %endif %if %{provide_legacy_shim} -%{efi_esp_dir}/shim.efi +%verify(not mtime) %{efi_esp_dir}/shim.efi %endif %changelog -* Thu Mar 09 2023 Eduard Abdullin - 15.6-1.el9.alma.1 +* Mon Feb 16 2026 Andrew Lukoshko - 16.1-5.el9.alma.1 +- Update to 16.1 + +* Fri Jul 26 2024 Eduard Abdullin - 15.8-4.el9_3.alma.2 +- Add SB for aarch64 + +* Fri May 10 2024 Eduard Abdullin - 15.8-4.el9_3.alma.1 - Use AlmaLinux cert -* Mon Jun 06 2022 Peter Jones - 15.6-1.el9 -- Update to shim-15.6 - Resolves: CVE-2022-28737 +* Tue Apr 16 2024 Peter Jones - 15.8-4 +- Bump the release to *-4* to work around a build system issue. + Related: RHEL-11259 -* Thu Apr 14 2022 Peter Jones - 15.5-2.el9 -- Attempt to make aarch64 build. - Related: rhbz#1932057 +* Wed Apr 10 2024 Peter Jones - 15.8-3 +- Bump the release to -3 to work around a build system issue. + Related: RHEL-11259 -* Thu Apr 14 2022 Peter Jones - 15.5-1.el9 -- Rebuild for rhel-9.0.0 - Resolves: rhbz#1932057 +* Thu Mar 28 2024 Peter Jones - 15.8-2.el8 +- Fix rpm verify issue found in testing. + Related: RHEL-11259 + +* Thu Mar 21 2024 Peter Jones - 15.8-1.el8 +- Update to shim-15.8 for CVE-2023-40547 + Resolves: RHEL-11259 + +* Wed Apr 20 2022 Peter Jones - 15.5-2.el8 +- Include the actual signed shim binaries. + Resolves: rhbz#1970632 + Resolves: rhbz#1982071 + Resolves: rhbz#2000946 + Resolves: rhbz#2002265 + +* Tue Apr 19 2022 Peter Jones - 15.5-1 +- Update to shim-15.5 + Resolves: rhbz#1970632 + Resolves: rhbz#1982071 + Resolves: rhbz#2000946 + Resolves: rhbz#2002265 * Mon Sep 21 2020 Javier Martinez Canillas - 15-16 - Fix an incorrect allocation size + Resolves: rhbz#1877253 * Fri Jul 31 2020 Peter Jones - 15-15 - Update once again for new signed shim builds. + Resolves: rhbz#1861977 * Tue Jul 28 2020 Peter Jones - 15-14 - Get rid of our %%dist hack for now. * Tue Jul 28 2020 Peter Jones - 15-13 - New signing keys + Related: CVE-2020-10713 + Related: CVE-2020-14308 + Related: CVE-2020-14309 + Related: CVE-2020-14310 + Related: CVE-2020-14311 * Thu Jun 11 2020 Javier Martinez Canillas - 15-12 - Fix firmware update bug in aarch64 caused by shim ignoring arguments + Resolves: rhbz#1830871 - Fix a shim crash when attempting to netboot + Resolves: rhbz#1795654 * Fri Jun 07 2019 Javier Martinez Canillas - 15-11 - Update the shim-unsigned-aarch64 version number + Related: rhbz#1715879 * Fri Jun 07 2019 Javier Martinez Canillas - 15-10 - Add a gating.yaml file so the package can be properly gated + Related: rhbz#1681809 * Wed Jun 05 2019 Javier Martinez Canillas - 15-9 - Bump the NVR + Related: rhbz#1715879 * Wed Jun 05 2019 Javier Martinez Canillas - 15-7 - Make EFI variable copying fatal only on secureboot enabled systems + Resolves: rhbz#1715879 - Fix booting shim from an EFI shell using a relative path + Resolves: rhbz#1717061 * Thu Mar 14 2019 Peter Jones - 15-6 - Fix MoK mirroring issue which breaks kdump without intervention + Resolves: rhbz#1668966 * Thu Jan 24 2019 Peter Jones - 15-5 - Rebuild for signing once again. If the signer actually works, then: + Resolves: rhbz#1620941 * Tue Oct 16 2018 Peter Jones - 15-4 - Rebuild for signing + Resolves: rhbz#1620941 * Mon Aug 13 2018 Troy Dawson - Release Bumped for el8 Mass Rebuild